CVE-2023-29007
HighCVSS 7.0Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
Git before versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1 contains a bug in handling .gitmodules files that allows injection of arbitrary configuration into $GIT_DIR/config when attempting to remove a submodule section. If injected values specify executables to run (e.g., core.pager, core.editor, core.sshCommand), this can lead to remote code execution.
Risk Assessment
Organizations using Git may be targeted if a user runs git submodule deinit on an untrusted repository, potentially resulting in malicious code execution.
Recommendation
Update Git to version 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, or 2.40.1. Avoid running git submodule deinit on untrusted repositories without prior inspection of submodule sections in $GIT_DIR/config.
Other vulnerabilities in Git
See all- CVE-2024-52005High
Git, when cloning, fetching, or pushing, transports informational and error messages from the remote process via the sideband channel, prefixing them with "remote:" and printing to standard error. Git did not protect against ANSI escape sequences, which a malicious actor can use to hide or misrepresent information or mislead the user into executing untrusted scripts.
- CVE-2017-14867High
Git versions before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 use unsafe Perl scripts to support subcommands, allowing attackers to execute arbitrary OS commands via shell metacharacters in a module name.
- CVE-2024-50349Medium
When Git asks for credentials via a terminal prompt (without using a credential helper), it prints the host name for which the credentials are requested. This may lead to unintended disclosure of the host name.
- CVE-2024-52006High
Git defines a line-based protocol used to exchange information between Git and Git credential helpers. Some ecosystems (most likely those using this protocol) may be vulnerable to attacks related to this protocol.
- CVE-2025-48385High
Git is a fast, scalable, distributed revision control system. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload.
- CVE-2015-7545Critical
In Git versions before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, there is a vulnerability that does not properly restrict allowed protocols in remote helper programs. This may allow remote attackers to execute arbitrary code via a URL in a .gitmodules file or other unknown sources in a submodule.
- CVE-2016-2324Critical
Integer overflow in Git before version 2.7.4 allows remote attackers to execute arbitrary code via (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
- CVE-2016-2315Critical
In git versions before 2.7.4, there is a bug in revision.c that uses an incorrect integer data type. This allows remote attackers to execute arbitrary code via (1) long filenames or (2) many nested trees, leading to a heap-based buffer overflow.
- CVE-2026-93326Medium
A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for example based on commit SHA, commit data, or signatures, then all these validations still apply correctly.
- CVE-2025-69160High
Gita versions up to 1.11 are vulnerable to unauthenticated local file inclusion.
Original NVD description (English source)
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS